13e5d0af5217c6e917e774f94111cebf4f27a91ff5dbbf592f4c071b1a76bb57

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f654b577cbd34d3ebd80d9f3824ac52_JaffaCakes118.html
Size

44KB
MD5

2f654b577cbd34d3ebd80d9f3824ac52
SHA1

2efeb1584df6549e8e8e181eb31b762c0d76f277
SHA256

13e5d0af5217c6e917e774f94111cebf4f27a91ff5dbbf592f4c071b1a76bb57
SHA512

0aea77539307acdb725a338a05af557f53f2e5001e0c795b3fb31cca423651bf54f3e0a82c1489cb0cf25accf8b77fba68959601f7b148f670a5b485c515f0b8
SSDEEP

384:1lU6APCiCFrp/lwZ97oK+whHSSS3NOXQRQFPykfBVoul:BAPC1FNUpXo+

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
4048	msedge.exe
4048	msedge.exe
960	identity_helper.exe
960	identity_helper.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3412	4048	msedge.exe	83
PID 4048 wrote to memory of 3412	4048	msedge.exe	83
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 3340	4048	msedge.exe	85
PID 4048 wrote to memory of 1200	4048	msedge.exe	86
PID 4048 wrote to memory of 1200	4048	msedge.exe	86
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87
PID 4048 wrote to memory of 3940	4048	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f654b577cbd34d3ebd80d9f3824ac52_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd1c046f8,0x7fffd1c04708,0x7fffd1c04718
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,9054085507697213641,798588738688330473,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1408 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
700B

MD5
ea81664a0d3254f9702de62ed8946f2b

SHA1
e86d10030c4a98ed1873da81d8e798e8062013e4

SHA256
876931fac900db23e8ac852bc9720e3426367e7d1784b77242caa41444993717

SHA512
06af64f2870fc76e45d91791ae582c716ffcac2e029442ad1a71b465bec31622f2ecf8efc5327207483e93d618a0b6a9bea3ba04862ee42a0599f68d65e5af50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3e738ed7c0179865bb7ca0f70db56f7

SHA1
52aa8b85390c03451b9fd676283553d859a60c67

SHA256
16b520d7ddf32b9db627cb765513cde2f77cb8b19914ef33c7bc868ae995f883

SHA512
534219601bbe29966f2020381f822b44207ff5d09cd92c4120e85793ec14814c52cedf10383daa2e5d476a3cae566934c01ab4c02fec5a00c3cde6fbabb99871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0fe997d2ecc1a60406e2369c1fc7ecf

SHA1
660ee7342dc4d515504df0658706c4dde9b86d67

SHA256
14fd048097344253655069fa50007f5cb8d580759f4012546f824a6d6313bbc3

SHA512
9d9126194217d4595da10f4b590bbd30f2de15e184ab15fc983a6a6aef366fe66e8ef3e7bd7ea82cbd8695431a2dcfc7c854152a9658de7e77c0494f1936fbe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b230d9dc-db8d-41d5-8907-9b9e31b99301.tmp

Filesize
6KB

MD5
30cb9d4f6374a1aba017c005496932b2

SHA1
bd449c86966db82a49e72502ae40d4bd34e91435

SHA256
fe386f0ff93c7478bbbe85d95d1777322e28277e566d730d14899a2ba00d53aa

SHA512
a6c8981589d292d44523c7d098c2fdcb32893aed4195f0b76d9f8627a16a34c62297f96ed359e793b40f117ca64222512189048d384d118cfbf177a472b104a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f01929d8b20e3cc751fa0429b24e3938

SHA1
f2d1b2ba159b0968637660cb96d54eac5f103657

SHA256
89754edf66871f809704377f41c912b3125590a659ba7da092d31fcb6210c56d

SHA512
c999b7ae94e1455aa126a8c2184b1c0b4f5aea6f1c1deb50e0f45b3bc1b64fc30230c3ff54fe0991167f79e2f81c4f765a25e54221f4f168516d6bcffd0571b3

Download Submit